[PATCH] [RHEL6] Fix SSH remediation scripts to be case-insensitive

Shawn Wells shawn at redhat.com
Mon Dec 16 16:41:50 UTC 2013


On 12/16/13, 11:34 AM, Jan Lieskovsky wrote:
> [RHEL6] Fix SSH remediation scripts to be case-insensitive
>
> Current version of various SSH remediation scripts for RHEL-6
> is searching (grep) and replacing (sed) particular /etc/ssh/sshd_config
> configuration file's option in case-sensitive manner (searching
> and replacing only strict matching exact case), therefore
>
> having, e.g:
>
> permitrootlogin yes
>
> in /etc/ssh/sshd_config would end up (in current state) the 'PermitRootLogin no'
> string to be appended at the end of the file, but keep the
> root logins allowed (since first option present in /etc/ssh/sshd_config
> is honoured by sshd).
>
> The proposal changes searches and replacements for various SSH daemon
> remediations to be case-insensitive, fixing this problem.
>
> Please review.
>
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Technologies Team
>
> 0001-RHEL6-Fix-SSH-remediation-scripts-to-be-case-insensi.patch
>
>
>  From 5033307ec5bc0759edcf455509b9208443356386 Mon Sep 17 00:00:00 2001
> From: Jan Lieskovsky<jlieskov at redhat.com>
> Date: Mon, 16 Dec 2013 17:19:01 +0100
> Subject: [PATCH] [RHEL6] Fix SSH remediation scripts to be case-insensitive
>
> Signed-off-by: Jan Lieskovsky<jlieskov at redhat.com>
> ---
>   RHEL6/input/fixes/bash/sshd_disable_empty_passwords.sh | 4 ++--
>   RHEL6/input/fixes/bash/sshd_disable_rhosts.sh          | 4 ++--
>   RHEL6/input/fixes/bash/sshd_disable_root_login.sh      | 4 ++--
>   RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh  | 4 ++--
>   RHEL6/input/fixes/bash/sshd_enable_warning_banner.sh   | 4 ++--
>   RHEL6/input/fixes/bash/sshd_set_idle_timeout.sh        | 4 ++--
>   RHEL6/input/fixes/bash/sshd_set_keepalive.sh           | 4 ++--
>   RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh    | 4 ++--
>   8 files changed, 16 insertions(+), 16 deletions(-)
>
> diff --git a/RHEL6/input/fixes/bash/sshd_disable_empty_passwords.sh b/RHEL6/input/fixes/bash/sshd_disable_empty_passwords.sh
> index f71fff1..c28fc77 100644
> --- a/RHEL6/input/fixes/bash/sshd_disable_empty_passwords.sh
> +++ b/RHEL6/input/fixes/bash/sshd_disable_empty_passwords.sh
> @@ -1,5 +1,5 @@
> -grep -q ^PermitEmptyPasswords /etc/ssh/sshd_config && \
> -  sed -i "s/PermitEmptyPasswords.*/PermitEmptyPasswords no/g" /etc/ssh/sshd_config
> +grep -qi ^PermitEmptyPasswords /etc/ssh/sshd_config && \
> +  sed -i "s/PermitEmptyPasswords.*/PermitEmptyPasswords no/gI" /etc/ssh/sshd_config
>   if ! [ $? -eq 0 ]; then
>       echo "PermitEmptyPasswords no" >> /etc/ssh/sshd_config
>   fi
> diff --git a/RHEL6/input/fixes/bash/sshd_disable_rhosts.sh b/RHEL6/input/fixes/bash/sshd_disable_rhosts.sh
> index 24d22db..e87e3c1 100644
> --- a/RHEL6/input/fixes/bash/sshd_disable_rhosts.sh
> +++ b/RHEL6/input/fixes/bash/sshd_disable_rhosts.sh
> @@ -1,5 +1,5 @@
> -grep -q ^IgnoreRhosts /etc/ssh/sshd_config && \
> -  sed -i "s/IgnoreRhosts.*/IgnoreRhosts yes/g" /etc/ssh/sshd_config
> +grep -qi ^IgnoreRhosts /etc/ssh/sshd_config && \
> +  sed -i "s/IgnoreRhosts.*/IgnoreRhosts yes/gI" /etc/ssh/sshd_config
>   if ! [ $? -eq 0 ]; then
>       echo "IgnoreRhosts yes" >> /etc/ssh/sshd_config
>   fi
> diff --git a/RHEL6/input/fixes/bash/sshd_disable_root_login.sh b/RHEL6/input/fixes/bash/sshd_disable_root_login.sh
> index ffd8262..e8b65aa 100644
> --- a/RHEL6/input/fixes/bash/sshd_disable_root_login.sh
> +++ b/RHEL6/input/fixes/bash/sshd_disable_root_login.sh
> @@ -1,5 +1,5 @@
> -grep -q ^PermitRootLogin /etc/ssh/sshd_config && \
> -  sed -i "s/PermitRootLogin.*/PermitRootLogin no/g" /etc/ssh/sshd_config
> +grep -qi ^PermitRootLogin /etc/ssh/sshd_config && \
> +  sed -i "s/PermitRootLogin.*/PermitRootLogin no/gI" /etc/ssh/sshd_config
>   if ! [ $? -eq 0 ]; then
>       echo "PermitRootLogin "no >> /etc/ssh/sshd_config
>   fi
> diff --git a/RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh b/RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh
> index b886e3c..fb3f545 100644
> --- a/RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh
> +++ b/RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh
> @@ -1,5 +1,5 @@
> -grep -q ^PermitUserEnvironment /etc/ssh/sshd_config && \
> -  sed -i "s/PermitUserEnvironment.*/PermitUserEnvironment no/g" /etc/ssh/sshd_config
> +grep -qi ^PermitUserEnvironment /etc/ssh/sshd_config && \
> +  sed -i "s/PermitUserEnvironment.*/PermitUserEnvironment no/gI" /etc/ssh/sshd_config
>   if ! [ $? -eq 0 ]; then
>       echo "PermitUserEnvironment no" >> /etc/ssh/sshd_config
>   fi
> diff --git a/RHEL6/input/fixes/bash/sshd_enable_warning_banner.sh b/RHEL6/input/fixes/bash/sshd_enable_warning_banner.sh
> index b1ad28f..24a385b 100644
> --- a/RHEL6/input/fixes/bash/sshd_enable_warning_banner.sh
> +++ b/RHEL6/input/fixes/bash/sshd_enable_warning_banner.sh
> @@ -1,5 +1,5 @@
> -grep -q ^Banner /etc/ssh/sshd_config && \
> -  sed -i "s/Banner.*/Banner \/etc\/issue/g" /etc/ssh/sshd_config
> +grep -qi ^Banner /etc/ssh/sshd_config && \
> +  sed -i "s/Banner.*/Banner \/etc\/issue/gI" /etc/ssh/sshd_config
>   if ! [ $? -eq 0 ]; then
>       echo "Banner /etc/issue" >> /etc/ssh/sshd_config
>   fi
> diff --git a/RHEL6/input/fixes/bash/sshd_set_idle_timeout.sh b/RHEL6/input/fixes/bash/sshd_set_idle_timeout.sh
> index 0a2d226..c491057 100644
> --- a/RHEL6/input/fixes/bash/sshd_set_idle_timeout.sh
> +++ b/RHEL6/input/fixes/bash/sshd_set_idle_timeout.sh
> @@ -1,8 +1,8 @@
>   source ./templates/support.sh
>   populate sshd_idle_timeout_value
>   
> -grep -q ^ClientAliveInterval /etc/ssh/sshd_config && \
> -  sed -i "s/ClientAliveInterval.*/ClientAliveInterval $sshd_idle_timeout_value/g" /etc/ssh/sshd_config
> +grep -qi ^ClientAliveInterval /etc/ssh/sshd_config && \
> +  sed -i "s/ClientAliveInterval.*/ClientAliveInterval $sshd_idle_timeout_value/gI" /etc/ssh/sshd_config
>   if ! [ $? -eq 0 ]; then
>       echo "ClientAliveInterval $sshd_idle_timeout_value" >> /etc/ssh/sshd_config
>   fi
> diff --git a/RHEL6/input/fixes/bash/sshd_set_keepalive.sh b/RHEL6/input/fixes/bash/sshd_set_keepalive.sh
> index d54ba21..17b83ec 100644
> --- a/RHEL6/input/fixes/bash/sshd_set_keepalive.sh
> +++ b/RHEL6/input/fixes/bash/sshd_set_keepalive.sh
> @@ -1,5 +1,5 @@
> -grep -q ^ClientAliveCountMax /etc/ssh/sshd_config && \
> -  sed -i "s/ClientAliveCountMax.*/ClientAliveCountMax 0/g" /etc/ssh/sshd_config
> +grep -qi ^ClientAliveCountMax /etc/ssh/sshd_config && \
> +  sed -i "s/ClientAliveCountMax.*/ClientAliveCountMax 0/gI" /etc/ssh/sshd_config
>   if ! [ $? -eq 0 ]; then
>       echo "ClientAliveCountMax 0" >> /etc/ssh/sshd_config
>   fi
> diff --git a/RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh b/RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh
> index a00eb95..264553f 100644
> --- a/RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh
> +++ b/RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh
> @@ -1,5 +1,5 @@
> -grep -q ^Ciphers /etc/ssh/sshd_config && \
> -  sed -i "s/Ciphers.*/Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc/g" /etc/ssh/sshd_config
> +grep -qi ^Ciphers /etc/ssh/sshd_config && \
> +  sed -i "s/Ciphers.*/Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc/gI" /etc/ssh/sshd_config
>   if ! [ $? -eq 0 ]; then
>       echo "Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc" >> /etc/ssh/sshd_config
>   fi
> -- 1.8.3.1

Ack (+thank you!)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131216/f4dec9e5/attachment.html>


More information about the scap-security-guide mailing list